Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "This is a set of seven bug fixes.  Several fcoe fixes for locking
  problems, initiator issues and a VLAN API change, all of which could
  eventually lead to data corruption, one fix for a qla2xxx locking
  problem which could lead to multiple completions of the same request
  (and subsequent data corruption) and a use after free in the ipr
  driver.  Plus one minor MAINTAINERS file update"

(only six bugfixes in this pull, since I had already pulled the fcoe API
fix directly from Robert Love)

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] ipr: Avoid target_destroy accessing memory after it was freed
  [SCSI] qla2xxx: Fix for locking issue between driver ISR and mailbox routines
  MAINTAINERS: Fix fcoe mailing list
  libfc: extend ex_lock to protect all of fc_seq_send
  libfc: Correct check for initiator role
  libfcoe: Fix Conflicting FCFs issue in the fabric

11 files changed, 61 insertions, 93 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 5be702cc8449..ad7e322ad17b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3220,7 +3220,7 @@ F:	lib/fault-inject.c
 
 FCOE SUBSYSTEM (libfc, libfcoe, fcoe)
 M:      Robert Love <robert.w.love@intel.com>
-L:      devel@open-fcoe.org
+L:      fcoe-devel@open-fcoe.org
 W:      www.Open-FCoE.org
 S:      Supported
 F:      drivers/scsi/libfc/
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index cd743c545ce9..795843dde8ec 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -1548,9 +1548,6 @@ static struct fcoe_fcf *fcoe_ctlr_select(struct fcoe_ctlr *fip)
 {
         struct fcoe_fcf *fcf;
         struct fcoe_fcf *best = fip->sel_fcf;
-        struct fcoe_fcf *first;
-
-        first = list_first_entry(&fip->fcfs, struct fcoe_fcf, list);
 
         list_for_each_entry(fcf, &fip->fcfs, list) {
                 LIBFCOE_FIP_DBG(fip, "consider FCF fab %16.16llx "
@@ -1568,17 +1565,15 @@ static struct fcoe_fcf *fcoe_ctlr_select(struct fcoe_ctlr *fip)
                                         "" : "un");
                         continue;
                 }
-                if (fcf->fabric_name != first->fabric_name ||
-                    fcf->vfid != first->vfid ||
-                    fcf->fc_map != first->fc_map) {
+                if (!best || fcf->pri < best->pri || best->flogi_sent)
+                        best = fcf;
+                if (fcf->fabric_name != best->fabric_name ||
+                    fcf->vfid != best->vfid ||
+                    fcf->fc_map != best->fc_map) {
                         LIBFCOE_FIP_DBG(fip, "Conflicting fabric, VFID, "
                                         "or FC-MAP\n");
                         return NULL;
                 }
-                if (fcf->flogi_sent)
-                        continue;
-                if (!best || fcf->pri < best->pri || best->flogi_sent)
-                        best = fcf;
         }
         fip->sel_fcf = best;
         if (best) {
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 82a3c1ec8706..6c4cedb44c07 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -8980,19 +8980,6 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg)
         if (!ioa_cfg->res_entries)
                 goto out;
 
-        if (ioa_cfg->sis64) {
-                ioa_cfg->target_ids = kzalloc(sizeof(unsigned long) *
-                                              BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
-                ioa_cfg->array_ids = kzalloc(sizeof(unsigned long) *
-                                             BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
-                ioa_cfg->vset_ids = kzalloc(sizeof(unsigned long) *
-                                            BITS_TO_LONGS(ioa_cfg->max_devs_supported), GFP_KERNEL);
-
-                if (!ioa_cfg->target_ids || !ioa_cfg->array_ids
-                        || !ioa_cfg->vset_ids)
-                        goto out_free_res_entries;
-        }
-
         for (i = 0; i < ioa_cfg->max_devs_supported; i++) {
                 list_add_tail(&ioa_cfg->res_entries[i].queue, &ioa_cfg->free_res_q);
                 ioa_cfg->res_entries[i].ioa_cfg = ioa_cfg;
@@ -9089,9 +9076,6 @@ out_free_vpd_cbs:
                             ioa_cfg->vpd_cbs, ioa_cfg->vpd_cbs_dma);
 out_free_res_entries:
         kfree(ioa_cfg->res_entries);
-        kfree(ioa_cfg->target_ids);
-        kfree(ioa_cfg->array_ids);
-        kfree(ioa_cfg->vset_ids);
         goto out;
 }
 
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index a1fb840596ef..07a85ce41782 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1440,9 +1440,9 @@ struct ipr_ioa_cfg {
         /*
          * Bitmaps for SIS64 generated target values
          */
-        unsigned long *target_ids;
-        unsigned long *array_ids;
-        unsigned long *vset_ids;
+        unsigned long target_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
+        unsigned long array_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
+        unsigned long vset_ids[BITS_TO_LONGS(IPR_MAX_SIS64_DEVS)];
 
         u16 type; /* CCIN of the card */
 
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index c772d8d27159..8b928c67e4b9 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -463,13 +463,7 @@ static void fc_exch_delete(struct fc_exch *ep)
         fc_exch_release(ep);    /* drop hold for exch in mp */
 }
 
-/**
- * fc_seq_send() - Send a frame using existing sequence/exchange pair
- * @lport: The local port that the exchange will be sent on
- * @sp:    The sequence to be sent
- * @fp:    The frame to be sent on the exchange
- */
-static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
+static int fc_seq_send_locked(struct fc_lport *lport, struct fc_seq *sp,
                        struct fc_frame *fp)
 {
         struct fc_exch *ep;
@@ -479,7 +473,7 @@ static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
         u8 fh_type = fh->fh_type;
 
         ep = fc_seq_exch(sp);
-        WARN_ON((ep->esb_stat & ESB_ST_SEQ_INIT) != ESB_ST_SEQ_INIT);
+        WARN_ON(!(ep->esb_stat & ESB_ST_SEQ_INIT));
 
         f_ctl = ntoh24(fh->fh_f_ctl);
         fc_exch_setup_hdr(ep, fp, f_ctl);
@@ -502,17 +496,34 @@ static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
         error = lport->tt.frame_send(lport, fp);
 
         if (fh_type == FC_TYPE_BLS)
-                return error;
+                goto out;
 
         /*
          * Update the exchange and sequence flags,
          * assuming all frames for the sequence have been sent.
          * We can only be called to send once for each sequence.
          */
-        spin_lock_bh(&ep->ex_lock);
         ep->f_ctl = f_ctl & ~FC_FC_FIRST_SEQ;   /* not first seq */
         if (f_ctl & FC_FC_SEQ_INIT)
                 ep->esb_stat &= ~ESB_ST_SEQ_INIT;
+out:
+        return error;
+}
+
+/**
+ * fc_seq_send() - Send a frame using existing sequence/exchange pair
+ * @lport: The local port that the exchange will be sent on
+ * @sp:    The sequence to be sent
+ * @fp:    The frame to be sent on the exchange
+ */
+static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
+                       struct fc_frame *fp)